# AI Risk Assessment > AI Risk Assessment is the systematic process of identifying potential Use when this capability is needed. - Skill: `tomevault-io/ai-risk-assessment` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/ai-risk-assessment` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/ai-risk-assessment/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/ai-risk-assessment --- # Ai Risk Assessment ## Skill Profile *(Select at least one profile to enable specific modules)* - [ ] **DevOps** - [x] **Backend** - [ ] **Frontend** - [ ] **AI-RAG** - [ ] **Security Critical** ## Overview AI Risk Assessment is the systematic process of identifying potential harms from AI systems, evaluating their likelihood and impact, and implementing mitigations. This is essential for responsible AI deployment and regulatory compliance. **Core Principle**: "Identify risks before they become incidents. Prevention is cheaper than remediation." This skill provides comprehensive guidance on assessing and mitigating AI risks across safety, privacy, security, and ethics dimensions. ## Why This Matters - ****: - ****: - ****: ## Core Concepts & Rules ### 1. Core Principles - Follow established patterns and conventions - Maintain consistency across codebase - Document decisions and trade-offs ### 2. Implementation Guidelines - Start with the simplest viable solution - Iterate based on feedback and requirements - Test thoroughly before deployment ## Inputs / Outputs / Contracts * **Inputs**: - * **Entry Conditions**: - * **Outputs**: - * **Artifacts Required (Deliverables)**: - * **Acceptance Evidence**: - * **Success Criteria**: - ## Skill Composition * **Depends on**: None * **Compatible with**: None * **Conflicts with**: None * **Related Skills**: None ## Quick Start # ## Assumptions - Risk categories are well-defined - Team has capacity to conduct assessments - Use cases are clearly documented - Regulatory requirements are known ## Compatibility - Works with any AI system - Compatible with all ML frameworks - Framework-agnostic approach - Adaptable to different risk categories ## Test Scenario Matrix | Scenario | Test Case | Expected Outcome | |----------|-----------|------------------| | Safety risk | Autonomous vehicle decision | Risk identified, mitigation in place | | Bias detection | Disparate impact across groups | Bias metrics measured, thresholds set | | Privacy risk | PII in training data | Data anonymized before training | | Security risk | Adversarial attack | Robustness score calculated, defenses implemented | | Ethical risk | Harmful content | Content filters in place, human review | ## Technical Guardrails & Security Threat Model ### 1. Security & Privacy (Threat Model) * **Top Threats**: Injection attacks, authentication bypass, data exposure - [ ] **Data Handling**: Sanitize all user inputs to prevent Injection attacks. Never log raw PII - [ ] **Secrets Management**: No hardcoded API keys. Use Env Vars/Secrets Manager - [ ] **Authorization**: Validate user permissions before state changes ### 2. Performance & Resources - [ ] **Execution Efficiency**: Consider time complexity for algorithms - [ ] **Memory Management**: Use streams/pagination for large data - [ ] **Resource Cleanup**: Close DB connections/file handlers in finally blocks ### 3. Architecture & Scalability - [ ] **Design Pattern**: Follow SOLID principles, use Dependency Injection - [ ] **Modularity**: Decouple logic from UI/Frameworks ### 4. Observability & Reliability - [ ] **Logging Standards**: Structured JSON, include trace IDs `request_id` - [ ] **Metrics**: Track `error_rate`, `latency`, `queue_depth` - [ ] **Error Handling**: Standardized error codes, no bare except - [ ] **Observability Artifacts**: - **Log Fields**: timestamp, level, message, request_id - **Metrics**: request_count, error_count, response_time - **Dashboards/Alerts**: High Error Rate > 5% ## Agent Directives 1. **Assess before deploy** - Never skip risk evaluation 2. **Use risk matrix** - Prioritize by likelihood × impact 3. **Implement guardrails** - Technical and process controls 4. **Test for vulnerabilities** - Red teaming and adversarial testing 5. **Document everything** - Maintain complete risk records ## Definition of Done AI risk assessment implementation is complete when: - [ ] Risk categories defined for all systems - [ ] Risk assessment framework implemented - [ ] Risk register established - [ ] Mitigation strategies documented - [ ] Monitoring in place for risks - [ ] Team trained on assessment procedures - [ ] Compliance requirements met - [ ] Documentation complete and up-to-date - [ ] Continuous review process established ## Anti-patterns 1. **Deploying without assessment** - Building AI without risk evaluation 2. **Ignoring high risks** - Not addressing critical vulnerabilities 3. **No monitoring** - Can't detect new risks 4. **Insufficient testing** - Not testing for vulnerabilities 5. **Poor documentation** - Incomplete risk records ## Reference Links # ## Versioning This skill follows semantic versioning (MAJOR.MINOR.PATCH): - **MAJOR**: Breaking changes to procedures or standards - **MINOR**: New assessment methods or significant enhancements - **PATCH**: Bug fixes or documentation updates --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/amnadtaowsoam) — claim your Tome and manage your conversions.